The invention belongs to the technical field of
software security measurement and evaluation, especially relates to a self-modifying code recognition method based on a
hardware simulator. The invention is provided with a marker in the
hardware simulator in order to only execute a target
executable file by one step and capture a virtual
system execute instruction, the information in the process can be executed by using a
shadow memory monitoring program, the code which is dynamically released into the memory and is executed can be recognized and executed in the course of program execution, so that
data information of the analysis target can be acquired. The
data acquisition of the invention is implemented by the
simulation hardware, is not executed by placing the malevolence code on a true CPU, so the actual
system can not be affected. The invention adopts the
hardware simulator as a dynamic analysis platform, which can improve the transparency between the analysis platform and the code and can effectively defend against the detection of the code.